Computing Tate-Shafarevich Groups of Elliptic Curves
Using Iwasawa Theory
William Stein and Christian Wuthrich
3rd May 2011

Abstract
We explain how to use results from Iwasawa theory to obtain information
about p-parts of Tate-Shafarevich groups of specific elliptic curves over Q. Our
method provides a practical way to compute #X(E/Q)(p) in many cases when
traditional p-descent methods are completely impractical and also in situations
where results of Kolyvagin do not apply, e.g., when the rank of the Mordell-Weilgroup is greater than 1. (The following is not done yet!) We apply our results
along with an explicit calculation to show that X(E/Q)(p) = 0 for all nonCM elliptic curves E over Q with conductor 6 140, 000, rank > 2, and good,ordinary primes p with 5 6 p < 1000 and surjective mod-p representation.

1

Introduction

The papers [GJP+ 09, Mil10] describe verification of the full Birch and SwinnertonDyer conjecture for elliptic curves of conductor 6 5000 with rank 6 1 by acomputational application of Euler system results of Kato and Kolyvagin combined with explicit descent. The main motivation for the present paper is todevelop algorithms using Iwasawa theory, in order to enable verification of theconjecture in new directions, e.g., verification of assertions about X(E/Q),
when E has rank at least 2. The present paper naturally complements related
projects by Perrin-Riou [PR03] and Coates [CLS09]. Moreover, we fill small
gaps in the literature (e.g., precision bounds in Section 3) and take the opportunity to correct errors in the literature (e.g., Lemma 4.2) that we found in thecourse of implementing algorithms.
In Sections 2–7 we recall the main objects and theorems involved in theclassical and p-adic Birch and Swinnerton-Dyer conjectures (BSD conjectures),correct some minor errors in the literature, and state a tight error bound that isessential for rigorous computation with p-adic L-series. These sections gather
together disparate results and provide unified notation and fill minor gaps.
In Section 3, we define p-adic L-functions and explain how to compute them.

1

Next we define the p-adic regulator, treating separately the cases of split multiplicative and supersingular reduction, and recall p-adic analogues of the BSD
conjecture. In Section 6, we recall the basic definitions and results for the
algebraic p-adic L-functions defined using Iwasawa theory. This leads to thestatement of the main conjecture and Kato’s theorem.
In Section 8 we discuss using p-adic results to bound X(E)(p) when E has
analytic rank 0, and Section 9 covers the case when the analytic rank is 1. In
Section 10 we describe a conditional algorithm for computing the rank of elliptic
curve that uses p-adic methods and hence differs in key ways from the standard
n-descent approach. Similarly, Section 11 contains an algorithm that applies
to curves of any rank, and either computes X(E/Q)(p) or explicitly disproves
some standard conjecture. In Section 12 we give examples that illustrate thealgorithms described above in numerous cases, including verifying for a rank
2 curve E that X(E/Q)(p) = 0 for a large number of p, as predicted by
the BSD conjecture. In particular, we prove the following theorem via an“enormous” computation of p-adic regulators and p-adic L-functions, which
provides evidence for the BSD conjecture for curves of rank at least 2:
Theorem 1.1 (Not really done yet!!).
Let E be a non-CM elliptic curve over Q with rank at least 2 and conductor
6140,000, and let p be a good ordinary prime for E with 5 6 p < 1000 suchthat the mod p representation is surjective. Then X(E/Q)(p) = 0.
[Todo: Can I add the following, given the computation I am doing: “Inparticular, the main conjecture holds at p for all such pairs (E, p) as above.”]

1.1

Background

Let E be an elliptic curve defined over Q and let
y 2 + a1 x y + a3 y = x3 + a2 x2 + a4 x + a6

(1.1.1)be the global minimal Weierstrass equation for E with a1 , a3 ∈ {0, 1} anda2 ∈ {−1, 0, 1}. Mordell proved that the set of rational points E(Q) is anabelian group of finite rank r = rank(E(Q)). Birch and Swinnerton-Dyer
conjectured that r = ords=1 L(E, s), where L(E, s) is the Hasse-Weil L-functionof E (see Conjecture 2.1 below). We call ran = ords=1 L(E, s) the analytic rankof E, which is defined since L(E, s) can be analytically continuted to all C (see[BCDT01]).
There is no known algorithm that has been proved to terminate that computes r in all cases. We can computationally obtain upper and lower bounds inany particular case. One way to give a lower bound on r is to search for linearly
independent points of small height via the method of descent. We can also use
constructions of complex and p-adic Heegner points in some cases to boundthe rank from below. To compute an upper bound on the rank r, in the caseof analytic ranks 0 and 1, we can use Kolyvagin’s work on the Euler systems

2

of Heegner points; in general, the only known method is to do an n-descentfor some integer n > 1. The 2-descents implemented by Cremona [Cre97], by
Simon [Sim02] in Pari [PAR06] (and SAGE [S+ 11]), and the 2, 3, 4, etc., descents in Magma [BCP97] (see also [CFO+ 08] and [CFO+ 06]), are particularly
powerful. But they may fail in practice to compute the exact rank due to thepresence of 2 or 3-torsion elements in the Tate-Shafarevich group.
The Tate-Shafarevich group X(E/Q) is a torsion abelian group associatedto E/Q. It is the kernel of the localization map
M
0 −→ X(E/Q) −→ H1 (Q, E) −→H1 (Qυ , E),υwhere the product runs over all places υ in Q. The arithmetic importanceof this group lies in its geometric interpretation. There is a bijection from
X(E/Q) to the Q-isomorphism classes of principal homogeneous spaces C/Qof E which have points everywhere locally. In particular, such a C is a curve of
genus 1 defined over Q whose Jacobian is isomorphic to E. Nontrivial elementsin X(E/Q) correspond to curves C that defy the Hasse principle, i.e., have apoint over every completion of Q, but have no points over Q.
Conjecture 1.2. (Shafarevich and Tate) The group X(E/Q) is finite.
The rank r and the Tate-Shafarevich group X(E/Q) are encoded in the
Selmer groups of E. Fix a prime p, and let E(p) denote the Gal(Q̄/Q)-moduleof all torsion points of E whose orders are powers of p. The Selmer group
Sp (E/Q) is defined by the following exact sequence:M
0 −→ Sp (E/Q) −→ H1 (Q, E(p)) −→H1 (Qυ , E) .
υ

Likewise, for any positive integer m, the m-Selmer group is defined by the exact
sequence
M
0 → S(m) (E/Q) → H1 (Q, E[m]) −→H1 (Qυ , E)υwhere E[m] is the subgroup of elements of order dividing m in E.
It follows from the Kummer sequence that there are short exact sequences
0 −→ E(Q)/mE(Q) −→ S(m) (E/Q) −→ X(E/Q)[m] −→ 0and0 −→ E(Q) ⊗ Qp /Zp −→ Sp (E/Q) −→ X(E/Q)(p) −→ 0 .
If the Tate-Shafarevich group is finite, then the Zp -corank of Sp (E/Q) is equal
to the rank r of E(Q).
The finiteness of X(E/Q) is only known for curves of analytic rank 0 and
1, in which case computation of Heegner points and Kolyvagin’s work on Euler
systems gives an explicit computable multiple of its order [GJP+ 09]. The group3

X(E/Q) is not known to be finite for even a single elliptic curve with ran > 2.
In such cases, the best we can do using current techniques is hope to boundthe p-part X(E/Q)(p) of X(E/Q), for specific primes p. Even this might nota priori be possible, since it is not known that X(E/Q)(p) is finite. However,
if it were the case that X(E/Q)(p) is finite (as Conjecture 1.2 asserts), thennthis could be verified by computing Selmer groups S(p ) (E/Q) for sufficiently
many n (see, e.g., [SS04]). Note that practical unconditional computation ofnS(p ) (E/Q) is prohibitively difficult for all but a few small pn .
We present in this paper two algorithms using p-adic L-functions Lp (E, T ).
They are p-adic analogs of the complex function L(E, s) (see Section 3 for thedefinition). Both algorithms rely heavily on the work of Kato [Kat04], whichis considered to be a major breakthrough in the direction of a proof of thep-adic version of the BSD conjecture (see Section 5). The possibility of using
these results to compute information about the Tate-Shafarevich group is wellknown to specialists and was for instance mentioned in [Col04b] which gives also
a nice overview of the p-adic BSD conjecture. For supersingular primes thesemethods have been used by Perrin-Riou in [PR03] to calculate X(E/Q)(p) in
many interesting cases when p is a prime of supersingular reduction.
Our first algorithm, which we describe Section 10, finds a provable upperbound for the rank r of E(Q) by computing approximations to the p-adic Lseries for various small primes p. Any upper bound on the vanishing of Lp (E, T )at T = 0 is also an upper bound on the rank r.
The second algorithm, which we discuss in Section 11, gives a new method
for computing bounds on the order of X(E/Q)(p), for specific primes p. We
will exclude p = 2, since traditional descent methods work well at p = 2, andIwasawa theory is not as well developed for p = 2. We also exclude someprimes p, e.g., those for which E has additive reduction, since much of thetheory we rely on has not yet been developed in this case yet.
Our second algorithm uses again the p-adic L-functions Lp (E, T ), but also
requires that the full Mordell-Weil group E(Q) is known. Its output, if ityields any information, is a proven upper bound on the order of X(E/Q)(p);in particular, it will often prove the finiteness of the p-primary part of the TateShafarevich group. But it will not in general be able to give any information
about the structure of X(E/Q)(p) as an abelian group or any information on
its elements. For such finer results on the Tate-Shafarevich group, one general
method is to use pn -descents as described above. In some cases, we can also use
visibility [AS02] to relate X(E/Q)(p) to Mordell-Weil groups of other elliptic
curves or abelian varieties. Assuming Kolyvagin’s conjecture, it may also be
possible to compute the structure of X(E/Q)(p), for E of any rank, by making
Kolyvagin’s Euler system explicit in some cases (see forthcoming work of thefirst author and Jared Weinstein that builds on [Kol91a], and the remarks at theend of [Kol91b]). The computability of the upper bound on #X(E/Q)(p) relies
on several conjectures, such as the finiteness of X(E/Q)(p) and Conjectures 4.1
and 4.4 on the nondegeneracy of the p-adic height on E.

4

Under the assumption of the main conjecture (see Section 7), the number
output by this algorithm equals the order of X(E/Q)(p). There are several cases when this conjecture is known to hold by Greenberg and Vatsal
in [GV00], by Grigorov in [Gri05], and in a forthcoming paper by Skinnerand Urban [SU10]. In particular, under appropriate hypothesis, [SU10] provethe main conjecture for elliptic curves with good ordinary reduction, see theorem 7.4. Thus in some cases, the upper bound on X(E/Q)(p) that we obtainis actually a lower bound too, if all the computations go through, e.g. thep-adic height is nondegenerate and we find enough points to verify that therank is equal to the order of vanishing.
Note that our algorithms can in principle be extended to give bounds insome cases on the rank of E(K) and #X(E/K)(p) for number fields K which
are abelian extensions of Q (here we still assume E is defined over Q).

Acknowledgments
We thank John Coates, Henri Darmon, Jerôme Grand’maison, Ralph Greenberg and Dimitar Jetchev for helpful discussions and comments. We are also
greatly indebted to Robert Pollack who shared his code for computing p-adic
L-functions and helped with the error estimates in Section 3. We also thankMark Watkins, who independently implemented some of the algorithms of thispaper, and in so doing found bugs in our implementation and discovered mistakes in an early draft of this manuscript.

2

The Birch and Swinnerton-Dyer conjecture

Let E be an elliptic curve defined over Q. If the BSD conjecture (Conjecture 2.1
below) were true, it would yield an algorithm to compute both the rank r andthe order of X(E/Q).
Let E be an elliptic curve over Q, and let L(E, s) be the Hasse-Weil Lfunction associated to the Q-isogeny class of E. According to [BCDT01] (which
completes work initiated in [Wil95]), the function L(E, s) is holomorphic on thewhole complex plane. Let ωE be the invariant differential dx/(2yR + a1 x + a3 ) ofa minimal Weierstrass equation (1.1.1) of E. We write ΩE = E(R) ωE ∈ R>0
for the Néron period of E.
Conjecture 2.1. (Birch and Swinnerton-Dyer)
1. The order of vanishing of the Hasse-Weil function L(E, s) at s = 1 isequal to the rank r = rank(E(Q)).
2. The leading term L∗ (E, 1) of the Taylor expansion of L(E, s) at s = 1
satisfiesQcυ · #X(E/Q)
L∗ (E, 1)= υ· Reg(E/Q)(2.0.2)ΩE(#E(Q)tor )25

where the Tamagawa numbers are denoted by cυ and Reg(E/Q) is theregulator of E, i.e., the discriminant of the Néron-Tate canonical heightpairing on E(Q).
Below we write #X(E/Q)an for the order of X(E/Q) that is predicted by
Conjecture 2.1.
Cassels proved in [Cas65] that if Conjecture 2.0.2 is true for an elliptic curve
E over Q, then it is true for all curves that are Q-isogenous to E.
Proposition 2.2 (Manin). If Conjecture 2.1 is true, then there is an algorithm
to compute r and #X(E/Q).
Proof. Manin proved this result in [Man71, §11], but we recall the essential
ideas here. By searching for points in E(Q) we obtain a lower bound on r,which gets closer to the true rank r the longer we run the search. At some point
this lower bound will equal r, but without using further information we have noway to know if that has occurred. As explained, e.g., in [Cre97, Coh07, Dok04],
we can for any k compute L(k) (E, 1) to any precision. Such computations
yield upper bounds on ran . In particular, if we compute L(k) (E, 1) and it isnonzero (to the precision of our computation), then ran < k. Eventually thismethod will also converge to give the correct value of ran , though again without
further information we do not know when this will occur. However, if we know
Conjecture 2.1, we know that r = ran , hence at some point the lower bound on
r computed using point searches will equal the upper bound on ran computed
using the L-series. At this point, by Conjecture 2.1 we know the true value ofboth r and ran .
Once r is known, we can compute E(Q) via a point search (as explainedin [Cre97, §3.5] or [Ste07a, §1.2]), hence we can approximate Reg(E/Q) to any
desired precision. All other quantities in (2.0.2) can also be approximated toany desired precision. Solving for #X(E/Q) in (2.0.2) and computing all otherquantities to large enough precision to determine the integer #X(E/Q)an thendetermines #X(E/Q), as claimed.
The above algorithm would only produce the order of X(E/Q) but no information about its structure as an abelian group. We could compute the structure of X(E/Q) by computing the group S(n) (E/Q) where n2 = #X(E/Q),
which is possible since S(m) (E/Q) is computable for all m. The algorithms in
Section 10 and 11 mimic the ideas of the proof of Proposition 2.2, but they
replace the complex L-function by a p-adic L-series.

3

The p-adic L-function

We will assume for the rest of this article that E does not admit complex
multiplication, though curves with complex multiplication are an area of active

6

research for these methods (see e.g., [Rub99, PR04, CLS09]).
Formulating a p-adic analogue of the BSD conjecture requires a p-adic analogue of the analytic function L(E, s), as introduced by Mazur and SwinnertonDyer [MSD74, MTT86]. In this section, we recall the definition of this p-adic
L-function, and fill a gap in the literature by giving a complete recipe for how
to compute it in all cases, including proven error bounds on each coefficient.
Let π : X0 (N ) −→ E be the modular parametrization and let cπ be theManin constant, i.e., the positive integer satisfying cπ · π ∗ ωE = 2πif (τ )dτ withf the newform associated to E. When E is an optimal quotient (so the dual
map E → Jac(X0 (N )) is injective), Manin conjectured that cπ = 1, and muchwork has been done toward this conjecture (see [Edi91, ARS06]).
Given a rational number r, define
Z i∞

Z i∞
+
λ (r) = πi ·f (τ ) dτ +f (τ ) dτ ∈ R.
−rr

R
There is a basis {γ+ , γ− } of H1 (E, Z) such that γ+ ωE is equal to ΩE if E(R)is connected and to 12 ΩE otherwise. By a theorem of Manin [Man72], we knowthat λ+ (r) belongs to Q · ΩE . For all r ∈ Q, the modular symbol [r]+ ∈ Q is[r]+ =λ+ (r).
ΩE+
In particular we have [0]+ = L(E, 1) · Ω−1
can be comE . The quantity [r]puted algebraically using modular symbols and linear algebra (see [Cre97] and[Ste07b]).
Let p be a prime of semistable reduction. We write1 ap for the trace of
Frobenius. Suppose first that E has good reduction at p. Then Np = p + 1 − ap
is the number of points on Ẽ(Fp ). Let X 2 − ap · X + p be the characteristic
polynomial of Frobenius and let α ∈ Q̄p be a root of this polynomial such that
ordp (α) < 1. There are two choices if E has supersingular reduction and there
is a single possibility for primes where E has good ordinary reduction. Now if
E has multiplicative reduction at p, then ap is 1 if it is split multiplicative andap is −1 if it is nonsplit multiplicative reduction. In either multiplicative case,
we take α = ap .
Define a measure on Z×
p with values in Q(α) by + a +
1· pak − αk+1
· pk−1
αk
 +
1
· pak
αk

(1
k

µα (a + p Zp ) =if E has good reduction,otherwise.

×
for any k > 1 and a ∈ Z×
p . Given a continuous character χ on Zp with values
in the completion Cp of the algebraic closure of Qp , we may integrate χ againstµα . Any invertible element x of Z×
p can be written as ω(x) · hxi where ω(x) is a
1

The context should make it clear if we speak about ap or a2 and a3 as in (1.1.1).

7

(p − 1)-st root of unity (or a 4-th root of unity when p = 2) and hxi belongs to
1 + 2pZp . We call ω the Teichmüller character. We define the analytic p-adic
L-function byZ
Lα (E, s) =hxis−1 dµα (x) for all s ∈ Zp .
Z×pwhere by hxis−1 we mean expp ((s − 1) · logp (hxi)). The function Lα (E, s)
extends to a locally analytic function in s on the disc defined by |s − 1| < 1(see [MTT86, §13]).
Let ∞G be the Galois group of the cyclotomic extension Q(µp∞ ) obtainedby adjoining to Q all p-power roots of unity. By κ we denote the cyclotomic
character ∞G −→ Z×
p . Because the cyclotomic character is an isomorphism,choosing a topological generator γ in Γ = ∞G4(p−1) amounts to picking agenerator κ(γ) in 1 + 2pZ×
p . With this choice, we may convert the function
Lα (E, s) into a p-adic power series in T = κ(γ)s−1 − 1. We write Lα (E, T ) for
this series in Qp (α)[[T ]]. We haveZ
log(x)(3.0.3)Lα (E, T ) =(1 + T ) log(κ(γ)) dµα (x) .
Z×p

Recall that ω(a) ∈ Z×
p is the Teichmüller lift of a. For each integer n > 1,
define a polynomial
p−1 pn−1
X−1XµE ω(a)(1 + p)j + pn Zp · (1 + T )j  .
Pn (T ) =a=1

j=0

Proposition 3.1. We havelim Pn (T ) = Lα (E, T ),

n→∞

where
the convergence is coefficient-by-coefficient,in the sense that if Pn (T ) =PPjjj an,j T and Lα (E, T ) =j aj T , then limn→∞ an,j = aj .
We now give a proof of this convergence and in doing so obtain an explicit
upper bound for |aj − an,j |, which is critical to making the computation ofLα (E, T ) algorithmic, and which appears to not be in the literature.
For any choice ζr of pr -th root of unity in Cp , let χr be the Cp -valuedrcharacter of Z×p of order p which factors through 1 + pZp and sends 1 + p to
ζr . Note that the conductor of χr is pr+1 .
Lemma 3.2. Let ζr be a pr -th root of unity with 1 6 r 6 n − 1, and let χr be
the corresponding character of order pr+1 , as above. ThenZ
Pn (ζr − 1) =χr dµE .
Z×p

In particular, note that the right hand side does not depend on n.

8

Proof. Writing χ = χr , we haven−1

Pn (ζr − 1) =p−1 p X−1
X
a=1

=
=

j=0

p−1 pn−1
X
X−1
a=1


µE ω(a)(1 + p)j + pn Zp · ζrjµE ω(a)(1 + p)j + pn Zp · χ (1 + p)j

j=0XµE (b + pn Zp ) · χ(b) =b∈(Z/pn Z)×Z
Z×pχ dµE .

In the second to the last equality, we use that
(Z/pn Z)× ∼= (Z/pZ)× × (1 + p(Z/pn Z))×
to sum over lifts of b ∈ (Z/pn Z)× of the form ω(a)(1 + p)j , i.e., a Teichmüller
lift times a power of (1 + p)j . In the last equality, we use that χ has conductor
pn , so is constant on the residue classes modulo pn , and use the Riemann sums
definition of the given integral.
n

For each positive integer n, let wn (T ) = (1 + T )p − 1.
Corollary 3.3. We have thatwn−1 (T ) divides Pn+1 (T ) − Pn (T ).
Proof. By Lemma 3.2, Pn+1 (T ) and Pn (T ) agree on ζj − 1 for 0 6 j 6 n − 1
and any choice ζj of pj -th root of unity, so their difference vanishes on every
n−1root of the polynomial wn−1 (T ) = (1 + T )p
− 1. The claimed divisibility
follows, since wn−1 (T ) has distinct roots.
P
P
Lemma 3.4. Let f (T ) = j bj T j and g(T ) = j cj T j be in O[T ] with O thering of integers of a finite field extension of Qp . If f (T ) divides g(T ), thenordp (cj ) > min ordp (bi ).
06i6j

Proof. We have f (T )k(T ) = g(T ). The lemma follows by using the definitionof polynomial multiplication and the nonarchimedean property of ordp on eachcoefficient of g(T ).
As above, let an,j be the j-th coefficient of the polynomial Pn (T ). Let
cn = max(0, − min ordp (an,j ))j9so that pcn Pn (T ) ∈ Zp [T ], i.e., cn is the smallest power of p that clears thedenominator. For any j > 0, let n
pen,j = min ordp
.
16i6j
i
be the min of the valuations of the coefficients of wn (T ), as in Lemma 3.4.
Proposition 3.5. For all n > 0, we have an+1,0 = an,0 , and for j > 0,
ordp (an+1,j − an,j ) > en−1,j − max(cn , cn+1 ).
Proof. Let c = max(cn , cn+1 ). The divisibility of Corollary 3.3 implies that
there is a polynomial h(T ) ∈ Qp [T ] withwn−1 (T ) · pc h(T ) = pc Pn+1 (T ) − pc Pn (T )and thus (by Gauss’ lemma) pc h(T ) ∈ Zp [T ] since the right hand side ofthe equation is integral and wn−1 (T ) is a primitive polynomial. Applying
Lemma 3.4 and renormalizing by pc gives the result.
For j fixed, en−1,j − max(cn+1 , cn ) goes to infinity as n grows since theck are uniformly bounded above (they are bounded in terms of the power of pthat divides the order of the cuspidal subgroup of E). Thus, {an,j } is a Cauchy
sequence and Proposition 3.5 implies that that
ordp (aj − an,j ) > en−1,j − max(cn+1 , cn ).

3.1

The p-adic multiplierIn this section we specialize the definition of p-adic multiplier from [MTT86,§14] to the case of an elliptic curve. For a prime of good reduction, we define
the p-adic multiplier by2
p = 1 − α1 .
(3.1.1)
Note that ordp (p ) is equal to 2 ordp (Np ) where Np = p + 1 − ap is the numberof points in the reduction Ẽ(Fp ) at p.
For a prime of bad multiplicative reduction, we put(
0
if p is split multiplicative,1p = 1 − α =2if p is nonsplit.

10

3.2

Interpolation property

The p-adic L-function constructed above satisfies an interpolation property
with respect to the complex L-function. For instance, we have that
Z
L(E, 1)Lα (E, 0) = Lα (E, 1) =dµα = p ·
.
ΩE
Z×
p
A similar formula holds when integrating nontrivial characters of Z×
p against
dµα . If χ is the character on ∞G sending γ to a root of unity ζ of exact order
pn , thenLα (E, ζ − 1) =

1
αn+1

·

pn+1
L(E, χ−1 , 1)
·
.
−1
G(χ )
ΩE

Here G(χ−1 ) is the Gauss sum and L(E, χ−1 , 1) is the Hasse-Weil L-functionof E twisted by χ−1 .

3.3

The good ordinary case

Suppose that the reduction of the elliptic curve at the prime p is good andordinary, so ap is not divisible by p. As mentioned before, in this case there
is a unique choice of root α of the characteristic polynomial x2 − ap x + p
that satisfies ordp (α) < 1. Since α is an algebraic integer, this implies that
ordp (α) = 0, so α is a unit in Zp . We get therefore a unique p-adic L-functionthat we will denote simply by Lp (E, T ) = Lα (E, T ).
Proposition 3.6. Let E be an elliptic curve with good ordinary reduction at aprime p > 2 such that E[p] is irreducible. Then the series Lp (E, T ) belongs to
Zp [[T ]].
Proof. See [GV00, Prop. 3.7] with χ = 1.
We next illustrate the above material with a few numerical examples, one
for each type of reduction. Let E0 /Q be the curve
E0 :y 2 + x y = x3 − x2 − 4 x + 4(3.3.1)

which is labeled 446d1 in Cremona’s tables [Cre]. The Mordell-Weil group
E0 (Q) is isomorphic to Z2 generated by the points (2, 0) and (1, −1). We
consider the prime p = 5 where E0 has good and ordinary reduction. As thenumber of points Np = 10 is divisible by p, this is an anomalous prime in theterminology of [Maz72]. Using [S+ 11], we compute an approximation to the11p-adic L-series as explained above with n = 5 to find
L5 (E0 , T ) = O(54 ) · T + (5 + 52 + 3 · 53 + O(54 )) · T 2+ (2 · 5 + 3 · 52 + 3 · 53 + O(54 )) · T 3 + (4 · 52 + 4 · 53 + O(54 )) · T 4+ (4 · 5 + 4 · 52 + O(53 )) · T 5+ (1 + 2 · 5 + 52 + 4 · 53 + O(54 )) · T 6 + O(T 7 ) .
Note that we claim here directly that the order of vanishing is at least to 1.
This follows from the interpolation formula that L5 (E0 , 0) = 0 as [0]+ = 0.
We will give an explanation for the vanishing of the term in T 1 later.[Todo:
Where? I couldn’t find this.] We remark that the term in T 2 has valuation 1,
but the coefficient of T 6 is a unit.

3.4

Multiplicative caseWe separate the case of split from the case of nonsplit multiplicative reduction.
In fact if the reduction is nonsplit, then the description of the good ordinarycase applies just the same. But if the reduction is split multiplicative (the “exceptional case” in [MTT86]), then the p-adic L-series must have a trivial zero,i.e., Lp (E, 0) = 0 because p = 0. By a result of Greenberg and Stevens [GS93](see also [Kob06] for a proof using Kato’s Euler system), we know thatlogp (qE ) L(E, 1)
d Lp (E, T )
1
·
·
=
dT
logp κ(γ) ordp (qE )ΩE
T =0
where qE denotes the Tate period of E over Qp . It is now known thanks
to [BSDGP96] that logp (qE ) is nonzero. Hence we define the p-adic L -invariant
aslogp (qE )Lp =6= 0 .
(3.4.1)
ordp (qE )We refer to [Col04a] for a detailed discussion of the different L -invariants andtheir connections.

3.5

The supersingular caseIn the supersingular case, that is when ap ≡ 0 (mod p), we have two roots
α and β both of valuation 12 . An analysis of the functions Lα and Lβ isin [Pol03]. The series Lα (E, T ) will not have integral coefficients in Qp (α).
Nevertheless we can still extract two integral series L±
p (E, T ). We will notneed this description.
There is a way of rewriting the p-adic L-series which relates more easily tothe p-adic height defined in the next section. We follow Perrin-Riou’s description in [PR03].

12

As before, ωE denotes the chosen invariant differential on E. Let ηE = x·ωE .
The pair {ωE , ηE } forms a basis of the Dieudonné module
Dp (E) = Qp ⊗ H1dR (E/Q).
This Qp -vector space comes equipped with a canonical Frobenius endomorphism ϕ that acts on it linearly. We normalize it in the following way, whichmakes it equal to p1 · F with F being the Frobenius as used in [MST06] orin [Ked01, Ked03, Ked04]. Let t be any uniformizer at the point OE at infinity on E, e.g., take t = − xy . Let ν be a class in Dp (E) represented by thePdifferential P cn · tn−1 dt with cn ∈ Qp . Then ϕ(ν) can be represented by thedifferential
cn · tpn−1 dt. In particular ϕ(dt) = tp−1 dt. The characteristic
polynomial of ϕ is equal to X 2 − p−1 ap X + p−1 .
Write Lα (E, T ) as G(T ) + α · H(T ) with G(T ) and H(T ) in Qp [[T ]]. Then
we defineLp (E, T ) = G(T ) · ωE + ap · H(T ) · ωE − p · H(T ) · ϕ(ωE ) ,which we view as a formal power series with coefficients in Dp (E) ⊗ Qp [[T ]],which contains exactly the same information as Lα (E, T ). See [PR03, §1] for a
direct definition. Since the invariant differential ωE depends on the choice of theWeierstrass equation (1.1.1), the expression Lp (E, T ) is also dependent on thischoice. However, if we write the series in the basis {ωE , ϕ(ωE )} rather thanin {ωE , ηE }, then the coordinates as above are independent. The Dp -valued
L-series satisfies again certain interpolation properties,2 e.g.,(1 − ϕ)−2 Lp (E, 0) =L(E, 1)· ωE ∈ Dp (E) .
ΩE

See Section 12.2 for an example.

3.6

Additive case

The case of additive reduction is much harder to treat, though we are optimisticthat such a treatment is possible. We have not tried to include the possibilityof additive reduction in our algorithm, especially because the existence of thep-adic L-function is not yet guaranteed in general. Note that there are twointeresting papers [Del98] and [Del02] of Delbourgo on this subject.

3.7

Quadratic twists

When the curve E is not semistable, we can try to use the modular symbols ofa quadratic twist E † of E in the computation of the p-adic L-function for E.
Perrin-Riou writes in [PR03] the multiplier as (1 − ϕ)−1 · (1 − p−1 ϕ−1 ) and she multiplies theright hand side with L(E/Qp , 1)−1 = Np · p−1 . It is easy to see that (1 − ϕ) · (1 − p−1 ϕ−1 ) =1 − ϕ + (ϕ − ap · p−1 ) + p−1 = Np · p−1 .
213This leads to dramatic speedups when the quadratic twist has lower conductor
than E.
Suppose that there exists a fundamental discriminant D of a quadratic fieldsatisfying the following conditions:• p does not divide D,• D2 divides N ,• M = N/D2 is coprime to D, and• the conductor N † of the quadratic twist E † of E by D is of the form M ·Q
with Q dividing D.
Then ψ = ( D· ) is the Dirichlet character associated to the quadratic field√Q( D) over which E and E † become isomorphic. Let fE† be the newformof level N † associated to the isogeny class of E † . As explained in [MTT86,§II.11], the twist of fE† by ψ is equal to fE and we can use their formula (I.8.3)
fE (τ ) =

1
G(ψ)

X
u mod |D|u 
ψ(u) · fE† τ +.
|D|(3.7.1)

Here G(ψ) is√ as before the Gauss sum of ψ, whose value we know to be thesquare root D of D in R>0 or in i · R>0 . Let cR be the number of connectedcomponents of E(R), which iscomponentsofR
R also the number of connected
+
ω
with
for
c
·
ω
,
similartoΩE † (R). We write Ω−† = Ω † = cR ·
E
R
E
+
−
†
E
γ
γ
E
E
the notations from (3.0.3). We also put
λ− (r) = πi ·Z i∞

Z i∞ −f (τ ) dτ
−r

r

+
−
∈ Q.
and [r]− = λ− (r)/Ω−
E . As for the modular symbol [r] , we have [r]Following [MTT86], we define the quantity η such that√sign(D)D · Ω+.
E = η · ΩE †It is known that η is either 1 or 2.
Now we can compute the modular symbol [r]+ for the curve E in terms of

14

modular symbols for E † . Suppose first that D > 0.
λ+E (r) = πi ·Z i∞

Z i∞ 
+
−r

r
D−1

πi X
=√
ψ(u)
D u=1

D−1


1 X
u
√
dτ
ψ(u)fE† τ +
D
D u=1

Z i∞

fE† (τ )dτ

r+u/D

Z i∞ 
D−1v
πi X
fE† τ + 1 −dτ+ √ψ(D − v)
D
D v=1
−r
!
Z i∞
Z i∞
D−1
πi X
fE† (τ )dτ
=√
ψ(u)
+
D u=1
r+u/D
−r−u/D
D−1

1 X
u
=√
.
ψ(u) λ+
r
+
†
E
D
D u=1

We used that ψ(u) = sign(D) ψ(D − u), that fE† (τ + 1) = fE† (τ ) and Equation (3.7.1). Similarly for D < 0, we find−1
λ+
E (r) = √

|D|−1


u
r
+
ψ(u) λ−
.
†
E
D
D u=1
X

Therefore, we have for any fundamental discriminant Dsign(D)[r]+E =η|D|−1

X

u=1

D h
u isign(D)
· r+
.
u
D E†

We can also express the unit eigenvalue α of Frobenius in terms of the corresponding α† unit eigenvalue for E † as
α = ψ(p) · α† .
In summary, we can evaluate the approximations to the p-adic L-function of
E using only modular symbols of the curve E † with smaller conductor. The
estimations for the error of these approximations remain exactly the same.
We recalled that the computation of the modular symbols [r]± can bedone purely algebraically. Unfortunately, the algebraic computation determines them only up to one single fixed choice of sign. If [0]+ is nonzero, we cansimply compare the value of the modular symbol at 0 with L(E, 1)/ΩE andadjust the sign when needed. If L(E, 1) = 0, we can use the above formula tocompute [0]+for some quadratic twist E † with nonvanishing L-value. So weE†
can easily adjust the unknown sign. Also, if we only know the modular symbols
up to a rational multiple, we can use these formulae to scale them.
We should also add here that we can not possibly do a similar thing withquartic or sextic twists when they exist. This is due to the fact that the15extension over which the twists become isomorphic is no longer an abelian
extension. So we would have to twist the modular symbols with a Galois
representation of dimension at least 2. Nevertheless there is a way of using
these twists for computing the p-adic L-function as explained in [CLS09], using
the fact that these curves have complex multiplication.

4

p-adic heights

The second term that we will generalize in the BSD formula is the real-valued
regulator. In p-adic analogues of the conjecture we replace it by a p-adic
regulator, which we define using a p-adic analogue of the height pairing. We
follow here the generalized version [BPR93] and [PR03].
Let ν be an element of the Dieudonné module Dp (E) (see Section 3.5). We
will define a p-adic height function hν : E(Q) −→ Qp which depends linearlyon the vector ν. Hence it is sufficient to define it on the basis ω = ωE andη = ηE .
If ν = ω, then we definehω (P ) = logE (P )2
where logE is the linear extension of the p-adic elliptic logarithm
logÊ : Ê(pZp ) −→ pZp
defined on the formal group Ê, by integrating our fixed differential ωE .
For ν = η, we define the p-adic sigma function of Bernardi as in [Ber81] tobe the solution σ of the differential equation


1 dσ
d
·
−x =
ωE σ ωE
such that σ(OE ) = 0, dσ
ω (OE ) = 1, and σ(−P ) = −σ(P ). If we denote byt = − xy the uniformizer at OE , we may develop the sigma function as a series
in t:σ(t) = t +a1 2 a21 + a2 3 a31 + 2a1 a2 + 3a3 4t +t +t + · · · ∈ Q((t)),
234where the ai are the coeff of Weierstrass equation (1.1.1). As a function on the1formal group Ê(pZp ), it converges for all t with ordp (t) > p−1.
We say that a point P in E(Q) has good reduction at a prime p if P reduces
to the identity component of the special fiber of the Néron model of E at p.
Given a point P in E(Q) there exists a multiple m · P such that σ(m · P )converges and such that m · P has good reduction at all primes. Denote bye(m · P ) ∈ Z the square root of the denominator of the x-coordinate of m · P .
Definee(m · P )2.
hη (P ) = 2 · logpm
σ(m · P )16

Bernardi [Ber81] proves that this function is quadratic and satisfies the parallelogram law.
Finally, if ν = a ω + b η then puthν (P ) = a hω (P ) + b hη (P ) .
Since this function is quadratic and satisfies the parallelogram law, it induces
a bilinear symmetric pairing h·, ·iν with values in Qp defined by
hP, Qiν =
1· hν (P + Q) − hν (P ) − hν (Q) .
2

Note that all these definitions are dependent on the choice of the Weierstrassequation. It is easy to verify that the pairing is zero if one of the points is atorsion point.

4.1

The good ordinary case

Since we have only a single p-adic L-function in the case that the reduction isgood ordinary, we have also to pin down a canonical choice of a p-adic heightfunction. This was first done by Schneider [Sch82] and Perrin-Riou [PR82].
We refer to [MT91] and [MST06] for more details.
Let να = a ω + b η be an eigenvector of ϕ on Dp (E) associated to theeigenvalue α1 . The value e2 = E2 (E, ωE ) = −12 · ab is the value of the Katz padic Eisenstein series of weight 2 at (E, ωE ). If a point P has good reduction at
all primes and lies in the range of convergence of σ(t), we define the canonicalp-adic height of P to be1· hνα (P )
b


a
e(P )
= − · logE (P )2 + 2 log
b
σ(P )




e(P )
e(P )
= 2 logp
=
2
log
.
p
e2
exp( 24logE (P )2 ) · σ(P )σp (P )ĥp (P ) =(4.1.1)

The function σp , defined by the last line, is called the canonical sigmafunction, see [MT91]; it is known to lie in Zp [[t]]. The p-adic height defined here
is up to a factor of 2 the same as in [MST06].3 It is also important to notethat the function ĥp is independent of the Weierstrass equation.
We write h·, ·ip for the canonical p-adic height pairing on E(Q) associated toĥp , and Regp (E/Q) for the discriminant of the height pairing on E(Q)/E(Q)tor .
Conjecture 4.1. (Schneider [Sch82]) The canonical p-adic height is nondegenerate on E(Q)/E(Q)tor . In other words, the canonical p-adic regulator
Regp (E/Q) is nonzero.
3

This factor is needed if we do not want to modify the p-adic version of the BSD conjecture(Conjecture 5.1).

17

Apart from the special case treated in [Ber82] of curves with complex multiplication of rank 1, there are hardly any results on this conjecture. See
also [Wut04].
We return to our running example curve E0 from Section 3.3. The methodsof [MST06, Har08] permit us to quickly compute to relatively high precision
the p-adic regulator of E0 . We have
E2 (E0 , ωE ) = 3 · 5 + 4 · 52 + 53 + 54 + 55 + 2 · 56 + 4 · 57 + 3 · 59 + O(510 ),and the regulator associated to the canonical p-adic height is
Regp (E0 /Q) = 2 · 5 + 2 · 52 + 54 + 4 · 55 + 2 · 57 + 4 · 58 + 2 · 59 + O(510 ).

4.2

The multiplicative case

When E has multiplicative reduction at p, we may use Tate’s p-adic uniformization (see for instance in [Sil94, Ch. V]). We have an explicit description of
the height pairing in [Sch82]. If we want to have the same closed formula in
the p-adic version of the BSD conjecture for multiplicative primes as for otherordinary primes, the p-adic height has to be changed slightly. We use here thedescription of the p-adic regulator given in [MTT86, §II.6]. Alas, their formula
is not correct, as explained in [Wer98], so we use the corrected version.
Let qE be the Tate parameter of the elliptic curve E over Qp , so we have anZanalytic homomorphism ψ : Q̄×p −→ E(Q̄p ) whose kernel is precisely qE . The
under
ψ
is
equal
to
the
subgroupofpoints
of
E(Q
)
lying
on theimage of Z×ppconnected component of the reduction modulo p of the Néron model of E. Let
×
C be the constant such that ψ ∗ (ωE ) = C · duu where u is a uniformizer of Qp
at 1. The value of the p-adic Eisenstein series of weight 2 isXXe2 = E2 (E, ωE ) = C 2 · 1 − 24 ·d · qEn  .
n>1 d|nThen we use the formula as in the good ordinary case to define the canonicale2sigma function σp (t(P )) = exp( 24logE (P )2 ) · σ(t(P )). We could also have useddirectly the formula
σp (u) =u − 1 Y (1 − qEn · u)(1 − qEn /u)·(1 − q n )2
u1/2 n>1bwhere u ∈ 1 + pZp is the unique preimage of P ∈ E(pZp ) under the Tatebparametrization ψ, where E is the formal group of E at p.
If the reduction is nonsplit multiplicative, then we use the same formula (4.1.1)
to define the p-adic height as for the good ordinary case.
Suppose that the reduction is split multiplicative. Let P be a point in E(Q)having good reduction at all finite places and with trivial reduction at p. Then18

we defineĥp (P ) = 2 logpe(P )σp (t(P ))−logp (u)2logp (qE )with u as above. The p-adic regulator is formed as before but with this modified
p-adic height ĥp .

4.3

The supersingular caseIn the supersingular case, we do not find a canonical p-adic height with values
in Qp . Instead, the height has values in the Dieudonné module Dp (E), as
explained in [BPR93] and [PR03].
First, if the rank of the curve is 0, we define the p-adic regulator of E/Q
to be ω = ωE ∈ Dp (E). Thus assume for the rest of this section that the rankr of E(Q) is positive. Let ν = a ω + b η be any element of Dp (E) not lying in
Qp ω, (so b 6= 0). It can be easily checked that the value of
Hp (P ) =1
· (hν (P ) · ω − hω (P ) · ν) ∈ Dp (E)bis independent of the choice of ν. We will call this the Dp -valued height on
E(Q). But note that it depends on the choice of the Weierstrass equation of
E: if we change coordinates by putting
x0 = u2 · x + r

y 0 = u3 · y + s · x + t,

and(4.3.1)then the Dp -valued height Hp0 (P ) computed in the new coordinates x0 , y 0 will
satisfy Hp0 (P ) = u1 · Hp (P ) for all points P ∈ E(Q).
On Dp (E) there is a canonical alternating bilinear form [·, ·] characterized
by the property that [ωE , ηE ] = 1. Write Regν ∈ Qp for the regulator of hνon E(Q)/E(Q)tor . Then we have the following lemma which is a correctedversion4 of [PR03, Lem. 2.6].
Lemma 4.2. Suppose that the rank r of E(Q) is positive. There exists a uniqueelement Regp (E/Q) in Dp (E) such that for all ν ∈ Dp (E) not in Qp ω, we have
[Regp (E/Q), ν] =Regν.
[ω, ν]r−1(4.3.2)Furthermore, if the rank r is 1, then Regp (E/Q) = Hp (P ) for a generator P .
If the Weierstrass equation is changed as in (4.3.1), the regulator Reg0p (E/Q)
computed in the new equation satisfies Reg0p (E/Q) = u1 · Regp (E/Q).
We call Regp (E/Q) ∈ Dp (E) the Dp -valued regulator of E/Q, or better, ofthe chosen Weierstrass equation.
4

The wrong normalization in [PR03] only influences the computations for curves of rank greaterthan 1. It seems that, by chance, the computations in [PR03] were done with a ν in Dp (E) suchthat [ω, ν] = 1, so that the normalization did not enter into the end results.

19

Proof. Since hω is made out of the square of the linear function logE , the matrixof the associated pairing on a basis {Pi } of E(Q) modulo torsion has entries ofthe form logE (Pi ) · logE (Pj ) and hence has rank 1. Therefore the regulator of
the pairing associated to ν = a · ω + b · η is equal toRegaω+bη = a · br−1 · X + br · Y
for some constants X and Y . In fact, we must have X = Regω+η − Regη and
Y = Regη . Therefore the expression on the right hand side of (4.3.2) is linear
in ν. More explicitly, we may define
Regp (E/Q) = Y · ω − X · η.
The formula for the case of rank 1 is then also immediate. The variance of theregulator with the change of the equation can be checked just as for Hp .
We continue to assume that the rank r of E/Q is positive, as in Lemma 4.2.
Define the fine Mordell-Weil group as in [Wut07] to be the kernel
M(E/Q) = ker E(Q) ⊗ Zp −→ E(Qp )p-adic completion ,which is a free Zp -module of rank r − 1. The bilinear form associated to thenormalized p-adic heighthν (P ),[ω, ν]
can be restricted to obtain a pairingh·, ·i0 : M(E/Q) × (E(Q) ⊗ Zp ) −→ Qp .
It is then independent of the choice of ν 6∈ Qp ω. We call the regulator of thisbilinear form h·, ·i0 on a basis of M(E/Q) the fine regulator Reg0 (E/Q) ∈ Qp ,which is an element of Qp defined up to multiplication by a unit in Zp .
Lemma 4.3. Let Q be a point in E(Q) ⊗ Zp such that M(E/Q) + Zp Q =E(Qp ) ⊗ Zp . Then
[Regp (E/Qp ), ω] ≡ logE (Q)2 · Reg0 (E/Q)(mod Z×p ).

Proof. From the proof of the previous lemma, we only have to show that
X = Regω+η − Regη ≡ hω (Q) Reg0 (E/Q). We choose a basis of M(E/Q)
and complete it to a basis of E(Q) ⊗ Zp by adding Q to it. If M is the matrixof the pairing for η in this basis, then the matrix for ω + η is obtained by changing the entry for hQ, Qi by adding hω (Q) to it. Since X is the difference ofthe two determinants, it is hω (Q) times the determinant of h·, ·iη on the basisof M(E/Q), which equals Reg0 (E/Q) by definition.

20

This lemma proves the last equality in section 2 of [PR03]. We should mention that the formula just above it, linking Regp (E/Q) to Hp (Q) · Reg0 (E/Q),
is not known to hold as it can not be assumed in general that we can find apoint Q as in the lemma above which is orthogonal to M(E/Q).
In particular, the Dp -valued regulator Regp (E/Q) is non-zero provided thefine regulator does not vanishes, because logE (Q) 6= 0.
Conjecture 4.4. (Perrin-Riou [PR93, Conjecture 3.3.7.i]) The fine regulator of E/Q is nonzero for all primes p. In particular, Regp (E/Q) 6= 0 for
all primes where E has supersingular reduction.
The conjecture 3.3.7.ii’) in [PR93], stating that Regν is non-zero for atleast one ν, is implied by the above conjecture. This is explained in the remarkiii) following the conjecture there, if we use the fact that the weak Leopoldt
conjecture is now known for E and p.
We have presented here how to compute the p-adic regulator in the basis{ω, η}, but in order to compare it later to the leading term of the p-adic Lfunction, it is better to write it in terms of the basis {ω, ϕ(ω)}. In particular,
we would then have a vector whose coordinates are independent of the chosen
Weierstrass equation.
In [BPR93, pg. 232], there is an algorithm for computing the action of ϕ bysuccessive approximation using the expansion of ω in terms of a uniformizer t.
It is much more efficient to replace this by the computation of ϕ using MonskyWashnitzer cohomology as explained in [Ked01, Ked03, Ked04, Har08].

4.4

Normalization

In view of Iwasawa theory, it is natural to normalize the heights and the regulators depending on the choice of the generator γ. In this way the heights
depend on the choice of an isomorphism Γ −→ Zp rather than on the Zp extension only. This normalization can be achieved by simply dividing ĥp (P )and hν (P ) by κ(γ). The regulators will be divided by logp κ(γ)r where r is therank of E(Q). Hence we write
Regγ (E/Q) =Regp (E/Q).
log(κ(γ))r

5 The p-adic Birch and Swinnerton-Dyer conjecture
5.1

The ordinary case

The following conjecture is due to Mazur, Tate and Teitelbaum [MTT86].
Rather than formulating it for the function Lα (E, s), we state it directly for21the series Lp (E, T ). It is then a statement about the expansion of this function
at T = 0 rather than at s = 1.
Conjecture 5.1. (Mazur, Tate and Teitelbaum [MTT86]) Let E be an
elliptic curve with good ordinary reduction or with multiplicative reduction ata prime p.
• The order of vanishing of the p-adic L-function Lp (E, T ) at T = 0 is
equal to the rank r, unless E has split multiplicative reduction at p inwhich case the order of vanishing is equal to r + 1.
• The leading term L∗p (E, 0) satisfies
Qcυ · #X(E/Q)∗· Regγ (E/Q)
Lp (E, 0) = p · υ(#E(Q)tor )2(5.1.1)

unless the reduction is split multiplicative in which case the leading termisQcυ · #X(E/Q)
Lp∗· υ· Regγ (E/Q),(5.1.2)
Lp (E, 0) =log(κ(γ))(#E(Q)tor )2
where Lp is as in Equation (3.4.1).
The conjecture assert exact equality, not just equality up to a p-adic unit.
However, the current approaches to the conjecture, which involve the main
conjecture of Iwasawa theory, prove results up to a p-adic unit, since the characteristic power series is only defined up to a unit, as we will see in Section 7.
Again, we consider the curve E0 (see Equation
Q (3.3.1)) for an example in
the good ordinary case. For this curve, we have cυ = 2 and E0 (Q)tor = 0, so
all the terms in the expression above can be computed except for the unknown
size of X(E0 /Q). The p-adic BSD conjecture predicts that
#X(E0 /Q) = 1 + O(53 )just as the complex BSD conjecture claims that the Tate-Shafarevich group#X(E0 /Q) is trivial.

5.2

The supersingular case

The conjecture in the case of supersingular reduction is given in [BPR93]
and [PR03]. The conjecture relates an algebraic and an analytic value in the
Qp -vector space Dp (E) of dimension 2. (The fact that we have two coordinates
was used by Kurihara and Pollack in [KP07] to construct global points via ap-adic analytic computation.)
We say that an element a(T ) · ωE + b(T ) · ηE in Dp (E) ⊗ Qp [[T ]] has orderd at T = 0 if d is equal to the minimum of the orders of a(T ) and b(T ).

22

Conjecture 5.2. (Bernardi and Perrin-Riou [BPR93]) Let E be an elliptic curve with supersingular reduction at a prime p.
• The order of vanishing of the Dp -valued L-series Lp (E, T ) at T = 0 is
equal to the rank r of E(Q).
• The leading term L∗p (E, 0) satisfies
Qcυ · #X(E/Q)−2∗· Regγ (E/Q)(1 − ϕ) · Lp (E, 0) = υ(#E(Q)tor )2∈ Dp (E) .
(5.2.1)

We emphasize that both sides of (5.2.1) are dependent on the Weierstrassequation. But under a change of the form x0 = u2 · x + r, they both get
multiplied by u1 and hence the conjecture is independent of this choice.

6

Iwasawa theory of elliptic curves

We suppose from now on that p > 2. Let ∞ Q be the cyclotomic Zp -extensionof Q, which is a Galois extension of Q whose Galois group is Γ. Let Λ be
the completed group algebra Zp [[Γ]]. We use a fixed topological generator γof Γ to identify Λ with Zp [[T ]] by sending γ to 1 + T . Any finitely generated
Λ-module admits a decomposition up to quasi-isomorphism as a direct sum ofelementary Λ-modules. Denote by n Q the n-th layer of the Zp -extension, sonn Q is a subfield of ∞ Q and Gal(n Q/Q) ≈ Z/p Z. As in Section 1.1, we define
the p-Selmer group of E over n Q by the exact sequenceM
0 −→ Sp (E/n Q) −→ H1 (n Q, E(p)) −→H1 (n Qυ , E)υwith the product running over all places υ of n Q. Over the full Zp -extension,
we define Sp (E/∞ Q) to be the direct limit lim Sp (E/n Q) with respect to the−→maps induced by the restriction maps H1 (n Q, E(p)) −→ H1 (n+1 Q, E(p)). The
group Sp (E/∞ Q) encodes information about the growth of the rank of E(n Q)
and of the size of X(E/n Q)(p) as n tends to infinity. We will consider the
Pontryagin dualX(E/∞ Q) = Hom (Sp (E/∞ Q), Qp /Zp ) ,which is a finitely generated Λ-module (see [CS00]). For further introduction
to these objects, see [Gre01].

6.1

The ordinary case

Assume that the reduction at p is either good ordinary or of multiplicative
type. Kato’s theorem (see [Kat04, Thm. 17.4]), which uses the work of Rohrlich [Roh84], states that X(E/∞ Q) is a torsion Λ-module, so we may associate23

to it a characteristic seriesfE (T ) ∈ Zp [[T ]](6.1.1)
×that is well-defined up to multiplication by a unit in Zp [[T ]] .
In analogy to the zeta-function of a variety over a finite field, we think offE (T ) as a generating function encoding the growth of the rank and the TateShafarevich group. For instance, the zeros of fE (T ) at T = ζ − 1 with ζ a rootof unity whose order is a power of p describe the growth of the rank. Since anonzero power series with coefficients in Zp can only have finitely many zeros,
we can deduce that the rank of E(n Q) has to stabilize in the tower n Q. In
other words, the Mordell-Weil group E(∞ Q) is still of finite rank.
The following result is due to Schneider [Sch85] and Perrin-Riou [PR82].
The multiplicative case is due to Jones [Jon89]. Note that it uses the analytic
and algebraic p-adic height defined by Schneider in [Sch82]; with the mentioned
correction by Werner they agree with our definition in Section 4.2.
Theorem 6.1 (Schneider, Perrin-Riou, Jones).
The order of vanishing of fE (T ) at T = 0 is at least equal to the rank r. It
is equal to r if and only if the p-adic height pairing is nondegenerate (Conjecture 4.1) and the p-primary part of the Tate-Shafarevich group X(E/Q)(p) is
finite (Conjecture 1.2). In this case the leading term of the series fE (T ) has
the same valuation asQcυ · #X(E/Q)(p)· Regγ (E/Q),
p · υ
(#E(Q)(p))2
unless the reduction is split multiplicative in which case the same formula holdswith p replaced by Lp / log(κ(γ)).
Let us consider again our running example curve E0 . We have computed the5-adic regulator and found that it is nonzero. The above theorem shows thatthe order of vanishing of fE0 (T ) is at least equal to the rank. The finitenessof X(E0 /Q)(5) is now equivalent to the statement that the order of vanishingof fE0 (T ) is equal to the rank 2 of E0 . If this is the case, then the leading
coefficient has valuation equal toord5 (fE∗ 0 (0)) = 1 + ord5 (#X(E0 /Q)(5)) .
If the valuation of the leading term of fE0 (T ) is positive we call p an irregularprime for E. For irregular primes either the Mordell-Weil rank of E over ∞ Q
is larger than the rank of E(Q) or the Tate-Shafarevich group X(E/∞ Q) is
no longer finite. We will determine exactly what happens for E0 with p = 5 in
Section 7.1 below.

6.2

The supersingular case

The supersingular case is more complicated, since the Λ-module X(E/∞ Q) is
not torsion. A beautiful approach to the supersingular case has been found by24

Pollack [Pol03] and Kobayashi [Kob03]. As mentioned above (in Section 3.5),
there are two p-adic series L±
p (E, T ) to which will correspond two new Selmer
groups X ± (E/∞ Q), which are Λ-torsion. Despite the advantages of this ±theory, we use the approach of Perrin-Riou here. See [PR03, §3].
Let Tp E be the Tate module and define H1loc to be the projective limit of
the cohomology groups H1 (n Qp , Tp E) with respect to the corestriction maps.
Here n Qp is the localization of n Q at the unique prime p above p. PerrinRiou [PR94] constructed a Λ-linear Coleman map Col from H1loc to a submoduleof Qp [[T ]] ⊗ Dp (E).
Define the fine Selmer group to be the kernel
R(E/n Q) = ker (S(E/n Q) −→ E(n Qp ) ⊗ Qp /Zp ) .
It is again a consequence of the work of Kato, namely [Kat04, Thm. 12.4], that
the Pontryagin dual Y (E/∞ Q) of R(E/∞ Q) is a Λ-torsion module. Denote bygE (T ) its characteristic series.
Let Σ be any finite set of places in Q containing the places of bad reduction
for E and the places ∞ and p. Let GΣ (n Q) denote the Galois group of the
maximal extension of n Q unramified at all places which do not lie above Σ.
Next we define H1glob as the projective limit of H1 (GΣ (n Q), Tp E). It is a Λmodule of rank 1 and it is independent of the choice of Σ.
By Kato again, the Λ-module H1glob is torsion-free and H1glob ⊗Qp has Λ⊗Qp rank 1. Choose now any element ∞ c in H1glob such that Zc = H1glob /(Λ · ∞ c)is Λ-torsion. Typically such a choice could be the “zeta element” of Kato, i.e.,
the image of his Euler system in H1glob . Write hc (T ) for the characteristic seriesof Zc . Then we define an algebraic equivalent of the Dp (E)-valued L-series byfE (T ) = Col(∞ c) · gE (T ) · hc (T )−1 ∈ Qp [[T ]] ⊗ Dp (E)where by Col(∞ c) we mean the image under the Coleman map Col of thelocalization of ∞ c to H1loc . The resulting series fE (T ) is independent of the
choice of ∞ c. Of course, fE (T ) is again only defined up to multiplication by aunit in Λ× .
Again we have a result due to Perrin-Riou [PR93]:
Theorem 6.2 (Perrin-Riou).
The order of vanishing of fE (T ) at T = 0 is at least equal to the rank r. It isequal to r if and only if the Dp (E)-valued regulator Regp (E/Q) is nonzero (Conjecture 4.4) and the p-primary part of the Tate-Shafarevich group X(E/Q)(p)is finite (Conjecture 1.2). In this case the leading term of the series (1 −ϕ)−2 fE (T ) has the same valuation asYcυ · #X(E/Q)(p) · Regp (E/Q) .
υ

25

Note that the proof of this theorem in the appendix of [PR03] for thesupersingular case uses the formula in Lemma 4.3 rather than the wrong definition of the regulator. Also we simplified the right hand term in comparison
to (5.2.1), because the reduction at p is supersingular, so Np ≡ 1 (mod p),
hence #E(Q)tor must be a p-adic unit.

7

The Main Conjecture

The main conjecture links the two p-adic power series (3.0.3) and (6.1.1) of theprevious sections. We formulate everything simultaneously for the ordinary
and the supersingular case, even if they are of quite different nature. We stillassume that p 6= 2.
Conjecture 7.1. (Main conjecture of Iwasawa theory for elliptic curves)
If E has good or nonsplit multiplicative reduction at p, then there exists an element u(T ) in Λ× such that Lp (E, T ) = fE (T ) · u(T ). If the reduction of E at
p is split multiplicative, then there exists such a u(T ) in T · Λ× .
The statement of the main conjecture for supersingular primes is equivalent to Kato’s formulation in [Kat04, Conj. 12.10] and to Kobayashi’s version
in [Kob03]. In the notation of Section 6.2, it asserts that gE (T ) = hc (T ), wherec is Kato’s zeta element.
Much is now known about this conjecture. To the elliptic curve E we attach
the representation
ρ̄p : Gal(Q̄/Q) −→ Aut(E[p]) ≈ GL2 (Fp )of the absolute Galois group of Q. Serre [Ser72] proved that ρ̄p is almost
always surjective (note our running hypothesis that E does not have complex
multiplication) and that for semistable curves surjectivity can only fail when
there is an isogeny of degree p defined over Q (see [Ser96] and [RS01, Prop. 1.1]
for the case p = 2.)
Kato’s Theorem 7.2.
Suppose that E has semistable reduction at p and that ρ̄p is surjective. Then
there exists a series d(T ) in Λ such that Lp (E, T ) = fE (T ) · d(T ). If the
reduction is split multiplicative then T divides d(T ).
The main ingredient for this theorem is in [Kat04, Thm. 17.4], which addresses the good ordinary case when ρ̄p is surjective. For the exceptional case
we refer to [Kob06], which treats the case of split multiplicative reduction (i.e.,
where exceptional zeroes appear).
For the remaining cases, we obtain only a weaker statement:

26

Kato’s Theorem 7.3.
Suppose that ρ̄p is not surjective. Then there is an integer m > 0 such thatfE (T ) divides pm · Lp (E, T ).
Greenberg and Vatsal [GV00] have shown that in certain cases the main
conjecture holds when E[p] is reducible. Recently, Skinner-Urban have shownin [SU10] the main conjecture in much larger generality.
Theorem 7.4 (Skinner-Urban).
Suppose that E has good ordinary reduction at p, that ρp is surjective and that
there exists a prime q of multiplicative reduction such that ρ̄p is ramified at q.
Then the main conjecture holds, i.e. Lp (E, T ) is equal to fE (T ), up to a unitin Λ.
The condition on the extra prime q is satisfied if E has split multiplicative
reduction at q and p does not divide the Tamagawa number cq . If E has
non-split multiplicative reduction, one has to check that p does not divide theTamagawa number over the unramified quadratic extension of Qq .

7.1

The Example

Consider again the curve E0 (see Equation (3.3.1)) and the good ordinary primep = 5. Kato theorem implies that fE0 (T ) divides Lp (E0 , T ). Since we havefound two linearly independent points of infinite order on E0 (Q), we know thatthe rank of E0 (Q) is at least 2. Hence the order of vanishing of fE0 (T ) at T = 0
is at least 2 and, by Theorem 7.2, so is the order of vanishing for Lp (E0 , T ).
By explicitly computing an approximation to Lp (E0 , T ) we see that the orderof vanishing cannot be larger than 2. Therefore the rank of E0 (Q) is equal tothe order of vanishing of the p-adic L-series.
But we know more now. The fact that the order of vanishing of fE0 (T )is equal to 2 shows that the 5-primary part of X(E0 /Q) cannot be infinite.
We compute the leading term of fE0 (T ) by computing Regp (E) and using
Theorem 6.1. Comparing the leading term of Lp (E0 , T ), which has valuation
1, and the leading term of fE0 (T ), which has valuation 1+ord5 (#X(E0 /Q)(5)),
shows that the 5-primary part of X(E0 /Q) is trivial.
Moreover, the series fE0 (T ) and Lp (E0 , T ) have the same leading term,
which implies that the main conjecture holds, i.e., fE0 (T ) ∈ Lp (E0 , T ) · Λ× .
By analyzing the series Lp (E0 , T ), it can be shown that
fE0 (T ) = T · ((T + 1)5 − 1) · u(T )for a unit u(T ) ∈ Λ× . Let 1 Q be the first layer of the Z5 -extension of Q. Unless
the Tate-Shafarevich group X(E/1 Q)(5) is infinite, Iwasawa theory predicts
that the rank of the Mordell-Weil group E0 (1 Q) is 6. Doing a quick search
it is easy to find points of infinite order in E0 (1 Q) which are not defined over
Q. Therefore, we know that the rank of E0 (1 Q) and of E0 (∞ Q) is 6 and27

that X(E0 /1 Q)(5) and X(E0 /∞ Q)(5) are finite. For more examples of suchfactorizations of p-adic L-series we refer to [Pol].

8

If the L-series does not vanish

Suppose the Hasse-Weil L-function L(E, s) does not vanish at s = 1. In thiscase, Kolyvagin proved that E(Q) and X(E/Q) are finite. In particular Conjecture 1.2 is valid; also, Conjectures 4.1 and 4.4 are trivially true in this case.
Let p > 2 be a prime of semistable reduction such that the representation ρ̄pis surjective. By the interpolation property, we know that Lp (E, 0) is nonzero,unless E has split multiplicative reduction.

8.1

The good ordinary caseIn the ordinary case we have−1
p · Lp (E, 0) =L(E, 1)= [0]+ ,ΩEwhich is a nonzero rational number by [Man72]. In the following inequality,
we use Theorem5 6.1 of Perrin-Riou and Schneider for the first equality and
Kato’s Theorem 7.2 on the main conjecture for the inequality in the second
line.
Q


υ cυ · #X(E/Q)(p)ordp p ·= ordp (fE (0))(#E(Q)(p))2
6 ordp (Lp (E, 0))L(E, 1)+ ordp (p )= ordpΩE
Hence, we have the following upper bound on the p-primary part of the TateShafarevich group
Q




cυ
L(E, 1)
ordp (#X(E/Q)(p)) 6 ordp
− ordpΩE(#E(Q)tor )2= ordp (#X(E/Q)an ).

(8.1.1)

Under the assumption of the main conjecture, this is sharp. In particular if
the conditions of Theorem 7.4 are satified for p, then we have the equality
ordp (#X(E/Q)(p)) = ordp (#X(E/Q)an ). This is Theorem 2.a in [SU10].
5

In the case of analytic rank 0, the theorem is actually relatively easy and well explainedin [CS00].[Todo: better ref: “chapter 3, Euler characteristic formula”?]

28

8.2

The multiplicative case

If the reduction is nonsplit, then the above holds just the same, because in all
the theorems involved the nonsplit case never differs from the good ordinarycase (only the split multiplicative case is exceptional). If instead the reductionis split multiplicative, we have that Lp (E, 0) = 0 andL0p (E, 0) =Lp
L(E, 1)
Lp·=· [0]+ 6= 0 .
log κ(γ)ΩElog κ(γ)

Since the p-adic multiplier is the same on the algebraic as on the analytic side,
we can once again compute as above to obtain the same bound (8.1.1).

8.3

The supersingular case

For the supersingular Dp (E)-valued series, we have
(1 − ϕ)−2 · Lp (E, 0) =L(E, 1)· ωE = [0]+ · ωE ,
ΩE

which is a nonzero element of Dp (E). The Dp (E)-valued regulator Regp (E/Q)
is equal to ωE . We may therefore concentrate solely on the coordinate in ωE .
Write ordp (fE (0)) for the p-adic valuation of the leading coefficient of the ωE coordinate of fE (T ). Again we obtain an inequality by using Theorem 6.2:!
Yordpcυ · #X(E/Q)(p) = ordp ((1 − ϕ)−2 fE (0))υ

6 ordp ((1 − ϕ)−2 Lp (E, 0))L(E, 1).
= ordpΩE
So we have once again that #X(E/Q)(p) is bounded from above by the highest
power of p dividing #X(E/Q)an .

8.4

Conclusion

Summarizing the above computations, we have
Theorem 8.1 (Kato, Perrin-Riou, Schneider).
Let E be an elliptic curve such that L(E, 1) 6= 0. Then X(E/Q) is finite and#X(E/Q)

C·

L(E, 1) (#E(Q)tor )2
Q
·
ΩE
cυ

where C is a product of a power of 2 and of powers of primes of additive reduction and of powers of primes for which the representation ρ̄p is not surjective.
This improves [Rub00, Cor. 3.5.19].

29

9

If the L-series vanishes to the first order

We suppose for this section that E has good and ordinary reduction at p andthat the complex L-series L(E, s) has a zero of order 1 at s = 1. Kolyvagin’s
theorem implies that X(E/Q) is finite and that the rank of E(Q) is equal to
1. Let P be a choice of generator of the Mordell-Weil group modulo torsion.
Suppose that the p-adic height ĥp (P ) is nonzero. A theorem of Perrin-Riou
in [PR87] asserts the following equality of rational numbers:
L0p (E, 0)
L0 (E, 1)
1
1
·
=
·
,
Reg(E/Q)ΩE
Regp (E/Q) (1 − α1 )2 · log(κ(γ))
where, on the left hand side, we have the canonical real-valued regulator
Reg(E/Q) = ĥ(P ) and the leading coefficient of L(E, s), while, on the righthand side, we have the p-adic regulator Regp (E/Q) = ĥp (P ) and the leading
term of the p-adic L-series. By the BSDQconjecture (or its p-adic analogue),this rational number should be equal to cυ · #X(E/Q) · (#E(Q)tor )−2 . By
Kato’s theorem, we know that the characteristic series fE (T ) of the Selmer
group divides Lp (E, T ), at least up to a power of p. Hence the series fE (T )has a zero of order 1 at T = 0 and its leading term divides the above rational
number in Qp (here we use that E(Q) has rank 1 so T | fE (T )). We thus arriveat the following theorem.
Theorem 9.1 (Kato, Perrin-Riou).
Let E/Q be an elliptic curve with good ordinary reduction at the odd prime p.
Assume that the p-adic regulator of E is nonzero. Suppose that the representation ρ̄p is surjective onto GL2 (Fp ). If L(E, s) has a simple zero at s = 1,
X(E/Q) is finite and(#E(Q)tor )2
L0 (E, 1)
1
Q
ordp (#X(E/Q)(p)) 6 ordp··cυ
Reg(E/Q)ΩE= ordp (#X(E/Q)(p)an ).
In other words the upper bound asserted by the BSD conjecture is true up
to a factor involving only bad and supersingular primes, and primes for which
the representation is not surjective.
The above theorem has as a hypothesis that the reduction is good ordinary,because this is the only case when we know a proof of the p-adic Gross-Zagier
formula. It would be interesting to obtain a generalization of the p-adic GrossZagier formula to the supersingular case.

30

10 The algorithm for an upper bound on therank
Let E/Q be an elliptic curve. In this section we explain how to compute upperbounds on the rank r of the Mordell-Weil group E(Q). For this purpose, wechoose a prime p satisfying the following conditions:• p > 2,• E has good reduction at p.
By computing the analytic p-adic L-function Lp (E, T ) to a certain precision,
we find an upper bound, say b, on the order of vanishing of Lp (E, T ) at T = 0.
Note that a theorem of Rohrlich [Roh84] guarantees that Lp (E, T ) is not zero.
Thenb > ordT =0 Lp (E, T ) > ordT =0 fE (T ) > r
by Kato’s Theorems 7.2 and 7.3 and by the theorems 6.1 and 6.2. Hence wehave an upper bound on the rank r.
Proposition 10.1. The computation of an approximation of the p-adic Lseries of E for an odd prime p of good reduction produces an upper bound on
the rank r of the Mordell-Weil group E(Q).
By searching for points of small height on E at the same time, one also
obtains a lower bound on the rank r. Simultaneously we can increase theprecision of the computation of the p-adic L-function in order to try to lower
the bound b. Eventually the lower bound is equal to the upper bound, unlessthe p-adic BSD Conjecture 5.1 or 5.2 is false. This is similar to the algorithm
described in Proposition 2.2, except that we do know here that our upperbounds are unconditional. But we do not know if the algorithm terminates
after finitely many steps. Summarizing we can claim the following.
Proposition 10.2. Let E be an elliptic curve, and assume that there is a prime
p of good reduction such that the p-adic BSD conjecture is true. Then there isan algorithm that computes the rank r of E using p-adic L-functions.
Of course, the algorithm for computing bounds on the rank r using mdescents has the same properties: it tries to determine the rank by searchingfor points and by bounding r from above by the rank of the various m-Selmer
groups. Unless all the p-primary parts of the Tate-Shafarevich group are infinite, this algorithm returns the rank r after a finite number of steps.
But the two algorithms are fundamentally different, since the m-descentalgorithm is fast and there are optimized implementations for small m, but itwould be prohibitively time-consuming for larger m (e.g., m > 13). In contrast,computing the p-adic L-series even for p around 1000 is reasonably efficient,assuming one can compute the relevant modular symbols spaces.

31

10.1

Technical remarks

The second condition above (good reduction) on the prime p is too strict. We
may actually allow primes of multiplicative reduction, too. Of course in the
exceptional case, when E has split multiplicative reduction, the upper boundb on the order of vanishing of the p-adic L-function Lp (E, T ) at T = 0 satisfiesb > r + 1.
Note that, assuming that the p-adic BSD conjecture holds, it is easy to
predict the needed precision in the computation of the p-adic L-series. So
we can compute immediately with the precision that should be sufficient andconcentrate on the search for points of small heights.
For practical purposes, we take p as small as possible. The computation of
the leading term of Lp (E, T ) for curves of higher rank r is time-consuming forlarge p. Also we should avoid primes p with supersingular or split multiplicative
reduction as there the needed precision is much higher and the computation ofb is much slower.
Also the speed of the computation of Lp (E, T ) using modular symbols depends on the size of the conductor. As the conductor grows, the determination of the rank, when it is larger than 1, using the descent method becomesmuch more efficient than the use of p-adic L-series computed using modular
symbols following the linear algebra algorithm of [Cre97]. However, using padic L-series may provide an enormous advantage when considering families ofquadratic twists.
An advantage to the descent method is that the determination of the mSelmer group for some m > 1 can be used for the search of points of infinite
order. If the elements of the Selmer group can be expressed as coverings, it ismore efficient to search for rational points on the coverings rather than on theelliptic curve itself.

11

The algorithm for the Tate-Shafarevich group

The second algorithm takes as input an elliptic curve E and a prime p and tries
to compute an upper bound on the p-primary part of X(E/Q). To apply the
results above, we impose the following conditions on (E, p):• p > 2,• E does not have additive reduction at p,• the image of ρ̄p is the full group GL2 (Fp ).
As mentioned above, these conditions apply to all but finitely many primes p.
Algorithm 11.1. Given an elliptic curve E/Q and a prime p satisfying the above
conditions, this procedure either gives an upper bound for #X(E/Q)(p) or terminates with an error.

32

1. Determine the rank r and the full Mordell-Weil group E(Q). Exit with anerror if we fail to do this.
2. Compute the p-adic regulator of E over Q using the efficient algorithm
in [MST06]. Exit with an error if the p-adic height pairing cannot be shown
to be nondegenerate.
3. Using modular symbols, compute an approximation of the leading termL∗p (E, 0) of the p-adic L-function Lp (E, T ). If the order of vanishingordT =0 Lp (E, T )is equal to r (or r + 1 if E has split multiplicative reduction at p), thenwe print that X(E/Q)(p) is finite, otherwise we increase the precision of
the computation of Lp (E, T ). If, after some prespecified cutoff, this fails toprove that ordT =0 Lp (E, T ) = r (or r + 1), then exit with an error.
4. Compute the remaining information, including the Tamagawa numbers cυ
and the p-adic multiplier p . If p is an good ordinary prime or a prime atwhich E has nonsplit multiplicative reduction, then let
bp = ordp (L∗p (E, 0)) + 2 · ordp (#(E(Q)(p))) − ordp (p )X−
ordp (cυ ) − ordp (Regγ (E/Q)) ,υ

if p is supersingular, let
bp = ordp ((1 − ϕ)−2 L∗p (E, 0)) − ordp (Regp (E/Q)) −X

ordp (cυ ) ,υand finally if E has split multiplicative reduction at p, let
bp = ordp (L∗p (E, 0)) + 2 · ordp (#(E(Q)(p)) − ordp (Lp )X−
ordp (cυ ) − ordp (Regγ (E/Q)) .
υ

5. Output that #X(E/Q)(p) is bounded by pbp .
Proof. At Step 4, we have shown that Conjecture 4.1 (or Conjecture 4.4 inthe supersingular case) on the nondegeneracy of the p-adic regulator holds
and that X(E/Q)(p) is indeed finite by Theorem 6.1 (or Theorem 6.2 in the
supersingular case). Moreover this theorem shows that
1(#E(Q)(p))2Q·
ordp (#X(E/Q)(p)) = ordp (fE∗ (0)) + ordp
p · υ cυ
Regγ (E/Q)
in the ordinary case (or the same formula where p replaces by Lp in the split
multiplicative case) andX
ordp (#X(E/Q)(p)) = ordp ((1−ϕ)−2 fE∗ (0))−ordp (Regp (E/Q))−
ordp (cυ )υ33

in the supersingular case. Finally, we use Kato’s Theorem 7.2 that
ordp (fE∗ (0)) 6 ordp (L∗p (E, 0))
to prove that bp is indeed an upper bound on ordp (#X(E/Q)(p)).
In the next proposition we summarize the discussion of this section.
Proposition 11.2. Let E be an elliptic curve and p > 2 a prime for which E
has semistable reduction. If Conjectures 4.1 and 4.4 hold and if we are able
to determine the Mordell-Weil group of E, then there is a algorithm to verify
that the p-primary part of X(E/Q) is finite. If moreover the representationρ̄p is surjective, then the algorithm produces an upper bound on #X(E/Q)(p).
If Conjecture 7.1 holds then the result of the algorithm is equal to the order of
X(E/Q)(p).

11.1

Technical remarks

In Step 1 we may use several ways to determine the rank and the Mordell-Weilgroup. E.g., first compute the modular symbol [0]+ . If it is not zero, we havethat L(E, 1) 6= 0 and the rank has to be 0. If the order of vanishing of L(E, s)
at s = 1 is 1, we may use Heegner points to find the full Mordell-Weil group,
which then is of rank 1. Otherwise we use descent methods or the algorithm
in the previous section to bound the rank from above and a search for points
to find a lower bound. When enough points are found to generate a group offinite index, we saturate the group using infinite descent in order to find thefull group E(Q). In practice this step does not create any problems as Step 3
is usually computationally more difficult.
In Step 3, it is easy to determine the precision that will be needed tocompute the p-adic valuation of the leading term L∗p (E, 0) if we assume thecomplex and the p-adic version of the BSD conjecture. Hence it is easy to
decide when to exit at this step.
The algorithm exits with an error only if the Mordell-Weil group could not
be determined (in Step 1), if Conjecture 4.1 or 4.4 is wrong (in Step 2), if thep-primary part of X(E/Q) is infinite or if the main conjecture is false (both in
Step 3). Hence only weaker variants of the p-adic Birch and Swinnerton-Dyer
conjecture are needed.
Another application of the algorithm is the following remark. If, for a given
elliptic curve E and a prime p, the algorithm yields the as output that the pprimary part of X(E/Q) is trivial, then the algorithm has actually also proved
the main conjecture for E and p. Because we know by then that Lp (E, T ) andthe characteristic series fE (T ) of the Selmer group have the same order ofvanishing at T = 0 and the leading terms have the same valuation. Since,by Kato’s theorem fE (T ) divides Lp (E, T ), we know then that the quotientis a unit in Zp [[T ]]. Such calculations and especially this remark on how to34verify the main conjecture in special cases are already contained in [PR03] forsupersingular primes p.

12

Numerical results

The algorithms described above were implemented by the authors in Sage (see[S+ 11]) and all of the calculations given below can be carried out using Sage.

12.1

A split multiplicative example

To give an example of a curve with split multiplicative reduction, we use thesame curve as before (see Equation (3.3.1))
E0 :y 2 + x y = x3 − x2 − 4 x + 4

but with the prime p = 223. Of course, there is no hope in practice that a
223-descent could be used to compute the order of X(E0 /Q)(223). We cancompute the p-adic regulator and the L -invariant to high precision quickly
using Tate’s parametrization of E0 :Regp (E0 /Q) = 153 · 2232 + 125 · 2233 + 124 · 2234 + O(2235 ),L = 179 · 223 + 85 · 2232 + 30 · 2233 + O(2234 ).
The computation of the p-adic L-series is more time consuming6 . But as weonly need the first p-adic digit to prove the triviality of X(E0 /Q)(223), weonly need to sum over 222 · 223 modular symbols. This yields
Lp (E0 , T ) = O(2234 )+O(2231 )·T +O(2231 )·T 2 +(139+O(223))·T 3 +O(T 4 ).
In fact, we know that the first three coefficients vanish as we are in the exceptional case, so the leading term has valuation 0. From these computations, we
see that the p-adic BSD conjecture predicts that
#X(E0 /Q) ≡ 1(mod 223);in particular, we may conclude that X(E0 /Q)(223) = 0.

12.2

A supersingular example

Let E be the elliptic curveE:y 2 + x = x3 + x2 + 2x + 2

6The optimized implementation mentioned in Section 12.5 takes less than one second total time,
including the modular symbols space computation.

35

listed as curve 1483a1 in Cremona’s tables. The curve has rank 2 generated by(−1, 0) and (0, 1). The reduction of E at p = 5 is supersingular. The p-adic
L-function equals
Lp (E, T ) = (1 + O(5)) · T 2 + (1 + O(5)) · T 3 + O(T 4 ) · ωE
+ (4 · 5 + O(52 )) · T 2 + (4 · 5 + O(52 )) · T 3 + O(T 4 ) · ϕ(ωE )where we have already taken in account that the first two terms vanish. We
compute the normalized Dp -valued regulatorRegγ (E/Q) = 1 + 2 · 5 + 3 · 52 + 53 + O(55 ) · ωE
+ 4 · 5 + 4 · 52 + 4 · 53 + 54 + 2 · 55 + O(56 ) · ϕ(ωE ) .
Hence the p-adic BSD conjecture predicts that
1 + O(5) ωE + 4 · 5 + O(52 ) ϕ(ωE ) =#X(E/Q) · 1 + O(5) ωE + 4 · 5 + O(52 ) ϕ(ωE ) .
In particular, we have shown that X(E/Q)(5) is trivial. It follows fromIwasawa-theoretic consideration as in [PR03] that, if #X(E/n Q)(5) = 5enthenp· pn + O(1) .
en = 2p −1

12.3 An example whose Tate-Shafarevich group is nontrivial
Let E be the elliptic curve given byE:

y 2 + x y = x3 + 16353089 x − 335543012233

which is labeled 858k2 in [Cre]. The curve has rank 0 and is semistable, and thefull BSD conjecture predicts that the Tate-Shafarevich group X(E/Q) consistsof two copies of Z/7Z.
We may compute the 7-adic L-series, which yields
L7 (E, T ) =72 · (2 · 72 + 73 + 74 + 3 · 75 + O(76 ) + (5 · 72 + O(73 )) · T+ (3 + 4 · 7 + 5 · 72 + O(73 )) · T 2 + O(T 3 ))On the algebraic side, we find that the constant term of the characteristic
series of E has valuation 2 + ord7 (#X(E/Q)). So our algorithm yields thecorrect upper bound, that #X(E/Q)(7) 6 72 . We can change to the curve
858k1 with a 7-isogeny and prove there directly that the upper bound on the
7-primary part of the Tate-Shafarevich group is 1, so by isogeny invariance of
the Birch and Swinnerton-Dyer conjecture it follows that #X(E/Q)(7) = 72 .
(Of course, this can be shown with other methods for this curve of rank 0,36

e.g., by using Heegner points.) Since we know the exact order of X(E/Q),
we deduce that the main conjecture holds. (Also, this can be deduced from
Theorem 7.4 taking q = 11.)
Once again we learn even more from the computation of the p-adic L-series.
Iwasawa theory tells us that the order of the Tate-Shafarevich group grows
quickly (for an ordinary prime) in the Z7 -extension. Namely if #X(E/n Q) =7en then en = 2 · 7n + 2 · n + O(1).

12.4

Application: Heegner Twists of High Rank

[Todo: Example. Insert the -824 twist example for 11a, where the twist has
rank 3. Show that Sha[p]=0 for small p, which will be useful in investigations
into koly.]

12.5 Application: Shafarevich-Tate Groups of Elliptic Curvesof Rank at Least 2
In this section, we describe the computation we did to verify Theorem 1.1, anddescribe the interesting anomalies that appeared. [Todo: write this up when
it is done; adjust 140,000 accordingly, since the computation is taking much
longer than I had anticipated. Maybe 140,000 gets replaced by 25,000?]
Mention here optimized psage implementation and the tricks it uses.

References[ARS06]

Amod Agashe, Kenneth Ribet, and William A. Stein, The Manin
constant, Pure Appl. Math. Q. 2 (2006), no. 2, 617–636.

[AS02]

Amod Agashe and William Stein, Visibility of Shafarevich-Tategroups of abelian varieties, J. Number Theory 97 (2002), no. 1,
171–185.

[BCDT01]

Christophe Breuil, Brian Conrad, Fred Diamond, and Richard
Taylor, On the modularity of elliptic curves over Q: wild 3-adic
exercises, J. Amer. Math. Soc. 14 (2001), no. 4, 843–939 (electronic).

[BCP97]

Wieb Bosma, John Cannon, and Catherine Playoust, The Magma
algebra system. I. The user language, J. Symbolic Comput. 24(1997), no. 3-4, 235–265, Computational algebra and number theory (London, 1993).

[Ber81]

Dominique Bernardi, Hauteur p-adique sur les courbes elliptiques,
Seminar on Number Theory, Paris 1979–80, Progr. Math., vol. 12,
Birkhäuser Boston, 1981, pp. 1–14.

37

[Ber82]

Daniel Bertrand, Valuers de fonctions thêta et hauteur p-adiques,
Seminar on Number Theory, Paris 1980-81, Progr. Math., vol. 22,
Birkhäuser Boston, 1982, pp. 1–11.

[BPR93]

Dominique Bernardi and Bernadette Perrin-Riou, Variante padique de la conjecture de Birch et Swinnerton-Dyer (le cas supersingulier), C. R. Acad. Sci. Paris Sér. I Math. 317 (1993), no. 3,
227–232.

[BSDGP96] Katia Barré-Sirieix, Guy Diaz, François Gramain, and Georges
Philibert, Une preuve de la conjecture de Mahler-Manin, Invent.
Math. 124 (1996), no. 1-3, 1–9.
[Cas65]J. W. S. Cassels, Arithmetic on curves of genus 1. VIII. On conjectures of Birch and Swinnerton-Dyer, J. Reine Angew. Math.
217 (1965), 180–199.

[CFO+ 06]

J. E. Cremona, T. A. Fisher, C. O’Neil, D. Simon, and M. Stoll,
Explicit n-descent on elliptic curves, II, III, preprints, 2006.

[CFO+ 08]

, Explicit n-descent on elliptic curves. I. Algebra, J. Reine
Angew. Math. 615 (2008), 121–155.

[CLS09]John Coates, Zhibin Liang, and Ramdorai Sujatha, The TateShafarevich group for elliptic curves with complex multiplication,
preprint, 2009.

[Coh07]Henri Cohen, Number theory. Vol. II. Analytic and modern tools,
Graduate Texts in Mathematics, vol. 240, Springer, New York,2007. MR MR2312338[Col04a]

Pierre Colmez, Invariants L et dérivées de valeurs propres deFrobenius, preprint, 2004.

[Col04b], La conjecture de Birch et Swinnerton-Dyer p-adique,Astérisque (2004), no. 294, ix, 251–319.

[Cre]

J. E. Cremona, Elliptic Curves Data, http://www.warwick.ac.
uk/~masgaj/ftp/data/INDEX.html.
John E. Cremona, Algorithms for modular elliptic curves, second
ed., Cambridge University Press, 1997.

[Cre97][CS00]

John Coates and Ramdorai Sujatha, Galois cohomology of elliptic
curves, Tata Institute of Fundamental Research Lectures on Mathematics, vol. 88, Narosa Publishing House, 2000.

[Del98]Daniel Delbourgo, Iwasawa theory for elliptic curves at unstableprimes, Compositio Math. 113 (1998), no. 2, 123–153.

[Del02], On the p-adic Birch, Swinnerton-Dyer conjecture for nonsemistable reduction, J. Number Theory 95 (2002), no. 1, 38–71.

[Dok04]

Tim Dokchitser, Computing special values of motivic L-functions,
Experiment. Math. 13 (2004), no. 2, 137–149. MR MR2068888(2005f:11128)

38

[Edi91][GJP+ 09]

[Gre01][Gri05][GS93][GV00][Har08][Jon89][Kat04][Ked01][Ked03][Ked04][Kob03][Kob06]

Bas Edixhoven, On the Manin constants of modular elliptic
curves, Arithmetic algebraic geometry (Texel, 1989), Progr.
Math., vol. 89, Birkhäuser Boston, Boston, MA, 1991, pp. 25–39.
G. Grigorov, A. Jorza, S. Patrikis, C. Tarnita, and W. Stein, Computational verification of the Birch and Swinnerton-Dyer conjecture for individual elliptic curves, Math. Comp. 78 (2009), 2397–
2425, http://wstein.org/papers/bsdalg/.
Ralph Greenberg, Introduction to Iwasawa theory for elliptic
curves, Arithmetic algebraic geometry (Park City, UT, 1999),
IAS/Park City Math. Ser., vol. 9, Amer. Math. Soc., Providence,
RI, 2001, pp. 407–464. MR 1860044 (2003a:11067)
Grigor Tsankov Grigorov, Kato’s Euler System and the Main Conjecture, Ph.D. thesis, Harvard University, 2005.
Ralph Greenberg and Glenn Stevens, p-adic L-functions and padic periods of modular forms, Invent. Math. 111 (1993), no. 2,
407–447.
Ralph Greenberg and Vinayak Vatsal, On the Iwasawa invariantsof elliptic curves, Invent. Math. 142 (2000), no. 1, 17–63.
David Harvey, Efficient computation of p-adic heights, LMS J.
Comput. Math. 11 (2008), 40–59.
John W. Jones, Iwasawa L-functions for multiplicative abelianvarieties, Duke Math. J. 59 (1989), no. 2, 399–420.
Kazuya Kato, p-adic Hodge theory and values of zeta functions of modular forms, Cohomologies p-adiques et application
arithmétiques. III, Astérisque, vol. 295, Société Mathématique deFrance, Paris, 2004.
Kiran S. Kedlaya, Counting points on hyperelliptic curves using
Monsky-Washnitzer cohomology, J. Ramanujan Math. Soc. 16(2001), no. 4, 323–338. MR MR1877805 (2002m:14019)
K. S. Kedlaya, Errata for: “Counting points on hyperelliptic curves
using Monsky-Washnitzer cohomology” [J. Ramanujan Math. Soc.
16 (2001), no. 4, 323–338, J. Ramanujan Math. Soc. 18 (2003),
no. 4, 417–418, Dedicated to Professor K. S. Padmanabhan. MR
2 043 934
K. Kedlaya, Computing zeta functions via p-adic cohomology, Algorithmic number theory, Lecture Notes in Comput. Sci., vol.
3076, Springer, Berlin, 2004, pp. 1–17.
Shin-ichi Kobayashi, Iwasawa theory for elliptic curves at supersingular primes, Invent. Math. 152 (2003), no. 1, 1–36.
Shinichi Kobayashi, An elementary proof of the Mazur-TateTeitelbaum conjecture for elliptic curves, Doc. Math. (2006),
no. Extra Vol., 567–575 (electronic).

39

[Kol91a][Kol91b]

V. A. Kolyvagin, On the structure of Selmer groups, Math. Ann.
291 (1991), no. 2, 253–259. MR 93e:11073, On the structure of Shafarevich-Tate groups, 94–121.

[KP07]

Masato Kurihara and Robert Pollack, Two p-adic L-functions andrational points on elliptic curves with supersingular reduction, Lfunctions and Galois representations, London Math. Soc. Lecture
Note Ser., vol. 320, Cambridge Univ. Press, Cambridge, 2007,
pp. 300–332.

[Man71]J. I. Manin, Cyclotomic fields and modular curves, Russian Math.
Surveys 26 (1971), no. 6, 7–78.

[Man72]

Ju. I. Manin, Parabolic points and zeta functions of modular
curves, Izv. Akad. Nauk SSSR Ser. Mat. 36 (1972), 19–66.

[Maz72]B. Mazur, Rational points of abelian varieties with values in towersof number fields, Invent. Math. 18 (1972), 183–266.

[Mil10]Robert L. Miller, Proving the Birch and Swinnerton-Dyer conjecture for specific elliptic curves of analytic rank zero and one,
http://arxiv.org/abs/1010.2431, 2010.

[MSD74]Barry Mazur and Peter Swinnerton-Dyer, Arithmetic of Weilcurves, Invent. Math. 25 (1974), 1–61.

[MST06]

Barry Mazur, William Stein, and John Tate, Computation of padic heights and log convergence, Doc. Math. (2006), no. Extra
Vol., 577–614 (electronic).

[MT91]

Barry Mazur and John Tate, The p-adic sigma function, Duke
Math. J. 62 (1991), no. 3, 663–688.

[MTT86]

Barry Mazur, John Tate, and J. Teitelbaum, On p-adic analoguesof the conjectures of Birch and Swinnerton-Dyer, Invent. Math.
84 (1986), no. 1, 1–48.

[PAR06]

The PARI Group, Bordeaux, PARI/GP, version 2.3.1, 2006,
available from http://pari.math.u-bordeaux.fr/.

[Pol]

Robert Pollack, Tables of iwasawa invariants of elliptic curves,
http://math.bu.edu/people/rpollack/Data/data.html.

[Pol03], On the p-adic L-function of a modular form at a supersingular prime, Duke Math. J. 118 (2003), no. 3, 523–558.

[PR82]

Bernadette Perrin-Riou, Descente infinie et hauteur p-adique surles courbes elliptiques à multiplication complexe, Invent. Math. 70(1982), no. 3, 369–398.

[PR87], Fonctions L p-adiques, théorie d’Iwasawa et points deHeegner, Bull. Soc. Math. France 115 (1987), no. 4, 399–456.

[PR93], Fonctions L p-adiques d’une courbe elliptique et points
rationnels, Ann. Inst. Fourier (Grenoble) 43 (1993), no. 4, 945–
995.

40

[PR94], Théorie d’Iwasawa des représentations p-adiques sur uncorps local, Invent. Math. 115 (1994), no. 1, 81–161, With anappendix by Jean-Marc Fontaine.

[PR03], Arithmétique des courbes elliptiques à réduction supersingulière en p, Experiment. Math. 12 (2003), no. 2, 155–186.

[PR04]

Robert Pollack and Karl Rubin, The main conjecture for CM
elliptic curves at supersingular primes, Ann. of Math. (2) 159(2004), no. 1, 447–464.

[Roh84]David E. Rohrlich, On L-functions of elliptic curves and cyclotomic towers, Invent. Math. 75 (1984), no. 3, 409–423.

[RS01]K. A. Ribet and W. A. Stein, Lectures on Serre’s conjectures,
Arithmetic algebraic geometry (Park City, UT, 1999), IAS/Park
City Math. Ser., vol. 9, Amer. Math. Soc., Providence, RI,
2001, http://wstein.org/papers/serre/, pp. 143–232. MR
2002h:11047[Rub99]Karl Rubin, Elliptic curves with complex multiplication and theconjecture of Birch and Swinnerton-Dyer, Arithmetic theory of
elliptic curves (Cetraro, 1997), Lecture Notes in Math., vol. 1716,
Springer, Berlin, 1999, pp. 167–234.

[Rub00], Euler systems, Annals of Mathematics Studies, vol. 147,
Princeton University Press, Princeton, NJ, 2000, Hermann Weyl
Lectures. The Institute for Advanced Study.

[S+ 11]W. A. Stein et al., Sage Mathematics Software (Version 4.6.2),
The Sage Development Team, 2011, http://www.sagemath.org.

[Sch82]

Peter Schneider, p-adic height pairings. I, Invent. Math. 69 (1982),
no. 3, 401–409.

[Sch85], p-adic height pairings. II, Invent. Math. 79 (1985), no. 2,
329–374.

[Ser72]

Jean-Pierre Serre, Propriétés galoisiennes des points d’ordre finides courbes elliptiques, Invent. Math. 15 (1972), no. 4, 259–331.

[Ser96], Travaux de Wiles (et Taylor, . . .). I, Astérisque (1996),
no. 237, Exp. No. 803, 5, 319–332, Séminaire Bourbaki, Vol.
1994/95.

[Sil94]

Joseph H. Silverman, Advanced topics in the arithmetic of elliptic
curves, Graduate Texts in Mathematics, vol. 151, Springer-Verlag,
New York, 1994.

[Sim02]

Denis Simon, Computing the rank of elliptic curves over number
fields, LMS J. Comput. Math. 5 (2002), 7–17 (electronic).

[SS04]

Edward F. Schaefer and Michael Stoll, How to do a p-descenton an elliptic curve, Trans. Amer. Math. Soc. 356 (2004), no. 3,
1209–1231.

41

[Ste07a]

William Stein, The Birch and Swinnerton-Dyer Conjecture, aComputational Approach, 2007, http://wstein.org/books/bsd/.

[Ste07b], Modular forms, a computational approach, Graduate
Studies in Mathematics, vol. 79, American Mathematical Society, Providence, RI, 2007, With an appendix by Paul E. Gunnells.
MR MR2289048[SU10]

C. Skinner and D. Urban, The Iwasawa Main Conjecture for GL2 ,http://www.math.columbia.edu/\%7Eurban/eurp/MC.pdf.

[Wer98]Annette Werner, Local heights on abelian varieties and rigid analytic uniformization, Doc. Math. 3 (1998), 301–319.

[Wil95]

Andrew Wiles, Modular elliptic curves and Fermat’s last theorem,
Ann. of Math. (2) 141 (1995), no. 3, 443–551.

[Wut04]

Christian Wuthrich, On p-adic heights in families of elliptic
curves, J. London Math. Soc. (2) 70 (2004), no. 1, 23–40.

[Wut07], Iwasawa theory of the fine Selmer group, J. Algebraic
Geom. 16 (2007), 83–108.

42